TI-2021-16558 Aliases CVE-2021-39172 GHSA-9jxw-cfrh-jxq6

New line injection during configuration edition

MEDIUM 61CWE-93Published 2021-08-27 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server. This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.

Why it matters now

EPSS 0.29172 98th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Cachet (fiveai): 2.5.1cachethq/cachet (Packagist): 2.5.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
fiveai	Cachet	before 2.5.1	2.5.1	Patch available	CNA
—	cachethq/cachet (Packagist)	before 2.5.1	2.5.1	Patch available	GHSA-9jxw-cfrh-jxq6

Cachet Vendorfiveai Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA
cachethq/cachet (Packagist) Vendor— Affected before 2.5.1 Fixed in 2.5.1 Patch available GHSA-9jxw-cfrh-jxq6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:catchethq:catchet::::::::	before 2.5.1	Vulnerable	Catchethq

cpe:2.3:a:catchethq:catchet:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·Catchethq

Remediation

Fix · CNA Cachet (fiveai) Fixed in 2.5.1
Fix · GHSA-9jxw-cfrh-jxq6 cachethq/cachet (Packagist) Fixed in 2.5.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-39172
2026-10-03 Alias added: GHSA-9jxw-cfrh-jxq6

References

Exploit 1

https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection/

Advisory 3

Other 3

TI-2021-16560 Configuration leak CVSS 3.1HIGH 8.8
TI-2021-16559 Forced reinstall CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences